High
BentoML: Dockerfile command injection via docker.base_image
Type: advisorySources: OSV
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line docker.base_image value smuggles arbitrary Dockerfile directives into the generated Dockerfile, and bentoml containerize then runs docker build which executes the injected RUN directives on the victim host. This vulnerability is fixed in 1.4.39.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-44345
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 01:31 UTC · Revision 1
Source evidence
BentoML: Dockerfile command injection via docker.base_image
core-osv · Original sourcePublished 27 May 2026, 17:24 UTC
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line docker.base_image value smuggles arbitrary Dockerfile directives into the generated Dockerfile, and bentoml containerize then runs docker build which executes the injected RUN directives on the victim host. This vulnerability is fixed in 1.4.39.
osv:CVE-2026-44345
Complete source record
{
"id": "6228a85702d3bd9e3430df648b7ed348e815c5c92feceb65e5adb40b270ee9a3",
"url": "https://osv.dev/vulnerability/CVE-2026-44345",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "BentoML: Dockerfile command injection via docker.base_image",
"summary": "BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line docker.base_image value smuggles arbitrary Dockerfile directives into the generated Dockerfile, and bentoml containerize then runs docker build which executes the injected RUN directives on the victim host. This vulnerability is fixed in 1.4.39.",
"evidence": "osv:CVE-2026-44345",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-44345",
"aliases": [
"CVE-2026-44345",
"GHSA-78f9-r8mh-4xm2",
"PYSEC-2026-189"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/bentoml/bentoml",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "e570eb2b1dd5ea49c09c261232a6b131a023d1b2"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "1.4.39"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"cpe": "cpe:2.3:a:bentoml:bentoml:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.4.39"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.4.38",
"v1.4.36",
"v1.4.35",
"v1.4.34",
"v1.4.33",
"v1.4.32",
"v1.4.31",
"v1.4.30",
"v1.4.29",
"v1.4.28",
"v1.4.27",
"v1.4.26",
"v1.4.25",
"v1.4.24",
"v1.4.23",
"v1.4.22",
"v1.4.21",
"v1.4.20",
"v1.4.19",
"v1.4.18",
"v1.4.17",
"v1.4.16",
"v1.4.15",
"v1.4.14",
"v1.4.13",
"v1.4.12",
"v1.4.11",
"v1.4.10",
"v1.4.8",
"v1.4.7",
"v1.4.6",
"v1.4.5",
"v1.4.4",
"v1.4.3",
"v1.4.2",
"v1.4.1",
"v1.4.0",
"v1.4.0a2",
"v1.4.0a1",
"v1.3.22",
"v1.3.21",
"v1.3.20",
"v1.3.19",
"v1.3.18",
"v1.3.17",
"v1.3.16",
"v1.3.15",
"v1.3.14",
"v1.3.13",
"v1.3.12",
"v1.3.11",
"v1.3.10",
"v1.3.9",
"v1.3.8",
"v1.3.7",
"v1.3.6",
"v1.3.5",
"v1.3.4post1",
"v1.3.4",
"v1.1.11",
"v1.3.3",
"v1.3.2",
"v1.3.1",
"v1.3.0",
"v1.2.20",
"v1.2.19",
"v1.2.18",
"v1.2.17",
"v1.2.16",
"v1.2.15",
"v1.2.14",
"v1.2.13",
"v1.2.12",
"v1.2.11",
"v1.2.10",
"v1.2.9",
"v1.2.8",
"v1.2.7",
"v1.2.6",
"v1.2.5",
"v1.2.4",
"v1.2.3",
"v1.2.2",
"v1.2.1a1",
"v1.2.1",
"v1.2.0",
"v1.1.10",
"v1.1.9",
"v1.1.8",
"v1.1.7",
"v1.1.6",
"v1.1.5",
"v1.1.4",
"v1.1.3",
"v1.1.2",
"v1.1.1",
"v1.1.0",
"v1.0.25",
"v1.0.24",
"v1.0.23",
"v1.0.22",
"v1.0.21",
"v1.0.20",
"v1.0.19",
"v1.0.18",
"v1.0.17",
"v1.0.16",
"v1.0.15",
"v1.0.14",
"v1.0.13",
"v1.0.12",
"v1.0.11",
"v1.0.10",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.0",
"v1.0.0-rc3",
"v1.0.0rc2",
"v1.0.0-rc2",
"v1.0.0-rc1",
"v1.0.0-rc0",
"v1.0.0-a7",
"v1.0.0-a6",
"v1.0.0-a5",
"v1.0.0-a4",
"v1.0.0-a3",
"v1.0.0-a2",
"v1.0.0-a1",
"v1.0.0-dev0",
"v0.13.1",
"v0.13.0",
"v0.12.1",
"v0.12.0",
"v0.11.0",
"v0.10.1",
"v0.10.0",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"v0.9.0.pre",
"v0.8.6",
"v0.8.5",
"v0.8.4",
"v0.8.3",
"v0.8.2",
"v0.8.1",
"v0.8.0",
"v0.7.8",
"v0.7.7",
"v0.7.5",
"v0.7.4",
"v0.7.3",
"v0.7.2",
"v0.7.1",
"v0.7.0",
"v0.6.3",
"v0.6.2",
"v0.6.1",
"v0.6.0",
"v0.5.8",
"v0.5.7",
"v0.5.6",
"v0.5.5",
"v0.5.4",
"v0.5.3",
"v0.5.2",
"v0.5.1",
"v0.5.0",
"v0.4.9",
"v0.4.8",
"v0.4.7",
"v0.4.6",
"v0.4.5",
"v0.4.4",
"v0.4.3",
"v0.4.2",
"v0.4.1",
"v0.4.0",
"bentoml-release-v0.3.4",
"bentoml-release-v0.3.3",
"0.2.1-beta",
"0.2.0-beta",
"0.1.2-beta",
"0.1.1-beta",
"0.0.8.post1-beta",
"0.0.5-alpha"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44345.json"
}
}
],
"modified": "2026-10-28T02:30:48.934075782Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44345.json",
"https://github.com/bentoml/BentoML/security/advisories/GHSA-78f9-r8mh-4xm2",
"https://nvd.nist.gov/vuln/detail/CVE-2026-44345"
],
"provider_metadata": {
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44345.json"
}
},
"related_cves": [
{
"value": "CVE-2026-44345",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 517003,
"published_at": "2026-05-27T17:24:18.789+00:00"
}